Use the audit record

Read and search your project's audit record, send its entries to your log tools, and check that no entry was changed or removed.

Every sign-in, grant, approval and denial in a project is written to one audit record, for people and AI agents alike. Read it in the AuthFI console, or send it to the log tools you already use.

Use this guide to find out who did what, to keep a copy of the record in your own systems, and to check that the record was not altered.

Before you begin

You need:

• Access to Security > Audit in the console.
• To send entries elsewhere: access to Integrations > Connections, and the details and the credential your destination needs. They are listed in Send entries to your log tools.

Read the record

In the console, open Security > Audit. The page lists the entries, newest first.

Entries come in pages. To see older entries, choose Load earlier events.

What an entry contains

Each entry records one event: who did something, what they did, and what they did it to.

{
  "id": "0d6c1b9e-...",
  "actor": "agent:agt_7c21...",
  "action": "agent.authorize.denied",
  "resource": "mcp:payments.refund",
  "recorded_at": "2026-10-10T09:14:07Z",
  "metadata": {
    "decision": "deny",
    "reason": "constraint:max",
    "request_id": "req_81f...",
    "country": "IN"
  }
}

metadata often carries these keys:

Search the record

On Security > Audit, narrow the record in two ways.

Choose a lens. The tiles at the top of the page each show one part of the record: Events, People & admin, AI response and Datapath. Choose a tile to see only that part.

Filter by actor or resource. Two fields filter the entries:

Filters match exactly. A partial name matches nothing.

To clear the filters, choose Show the whole record.

Count denials

In the console, open Security > Signals. Choose Last 24 hours, Last 7 days or Last 30 days.

The page counts the denials in that time. The table groups them by the reason given and the gate that denied the request, in the columns Cause, Refused at and Refusals.

How long entries are kept

The audit record is kept for 15 days on the Team plan and 30 days on the Professional plan. On the Enterprise plan you set the period yourself.

To keep entries longer, send them to a log tool as they are written. Entries you export are yours to keep for as long as you need.

Send entries to your log tools

A log destination is a connection in your project.

Risk findings can also be sent to PagerDuty, AWS Security Hub and Google Security Command Center. Add them the same way, under Where security findings go and Who gets paged.

What a destination receives

Entries are sent in batches, about once a minute. An HTTPS endpoint receives them as newline-delimited JSON. Each line sent is one entry:

{
  "id": "0d6c1b9e-...",
  "tenant_id": "...",
  "actor": "user:[email protected]",
  "action": "login.succeeded",
  "resource": "app:grafana",
  "recorded_at": "2026-10-10T09:14:07Z",
  "metadata": {}
}

Check that it works

Sign in to an application in the project, then look in your destination. Within about a minute, a batch arrives that contains a login.succeeded entry with your own account as actor.

The same entry appears on Security > Audit. Enter your own account in Who, for example user:[email protected], to find it.

Check that the record was not altered

Entries are chained. Each entry carries a hash computed from the entry before it and from its own contents. An entry cannot be changed, removed or inserted without breaking every hash after it.

The console checks the chain each time you open Security > Audit, and shows the result in a banner at the top of the page.

Record intact also reports how many entries were checked, and how many exist in all.

The check looks for four things:

• A gap in the numbering
• A link that does not match
• A missing entry
• An entry whose contents no longer produce its hash

Troubleshooting

Next steps